Recover from an XP Corrupted Registry

(It is highly recommended you print this file out for future reference since it will not be available on your computer)

Read this entire article before starting, only takes a few minutes and could save you hours.

DISCLAIMER OF DAMAGES
ALMOST ALL DIGITAL ELECTRONICS assumes no liability for damages, direct or consequential, which may result from the use of this information, even if ALMOST ALL DIGITAL ELECTRONICS has been advised of the possibility of such damages.

although, since you were just about to reformat your hard drive and start all over installing and registering your applications and restoring your backed up data you have little to lose.

How to Recover from a Corrupted Registry that Prevents Windows XP from Starting

Error messages similar to the following are displayed and you cannot boot to XP, Safe Mode etc

Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SOFTWARE

Stop: c0000218 {Registry File Failure} The registry cannot load the hive (file): \SystemRoot\System32\Config\SOFTWARE or its log or alternate

Hey Neil

Some ‘fun facts’ for you.

I had the dreaded c0000218 Registry error on a laptop.

1-your XP hints were great. Thank you!! Because I have no restore disk (typical for OEM, I guess), I read a ton of conflicting stuff.

2-from previous ‘messing around’, I knew about Puppy Linux. http://puppylinux.org/main/Overview%20and%20Getting%20Started.htm

Very easy, powerful, great interface. You can run from a CD/DVD or, even better, a flash drive. It accessed all the laptop files right away once the drive was ‘mounted’.

Upshot: I was able to copy the 5 config files directly from a sys-vol history location and get the Registry back in working order. Had I been a little more up on what I was doing, maybe a 5 minute job!!

Anyway, thanks much for the web page and info.

Michael

While you still can!!!! Create the following files in the C:\windows\ directory. This is important since recovery console can only access the C:\windows directory.

You can do so by copying and pasting the text below into notepad and save-as the result to C:\windows.

copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default

del c:\windows\system32\config\sam
del c:\windows\system32\config\security
del c:\windows\system32\config\software
del c:\windows\system32\config\default
del c:\windows\system32\config\system
copy c:\windows\tmp\_registry_machine_software c:\windows\system32\config\software
copy c:\windows\tmp\_registry_machine_system c:\windows\system32\config\system
copy c:\windows\tmp\_registry_machine_sam c:\windows\system32\config\sam
copy c:\windows\tmp\_registry_machine_security c:\windows\system32\config\security
copy c:\windows\tmp\_registry_user_.default c:\windows\system32\config\default

Next create a C:\windows\tmp directory. or you can do this from the recovery console if manually typing in the dos commands.

In addition is is convenient to install the recovery console, described below, as a STARTUP OPTION in the boot menu which appears following a reboot.

NOTE: a boot menu does not appear unless you have multiple operating systems. Recovery Console is an additional operating system so the boot menu will appear if it is installed.

Installing the Recovery Console

You can install the Recovery Console on your computer to make it available in case you are unable to restart Windows. You can then select the Recovery Console option from the list of available operating systems on startup. It is wise to install the Recovery Console on important servers, and on the workstations of IT personnel. This article describes how you can install the Recovery Console to your Windows XP computer. To install the Recovery Console, you must have administrative rights on the computer.

Although you can run the Recovery console by booting directly from the Windows XP CD, it's much more convenient to set it up as a startup option on your boot menu. To run directly by booting from the CD see the "Using the Recovery Console" section later in this article.

To install the Recovery Console, perform the following steps:

SUMMARY

This article describes how to recover a Windows XP system that does not start because of corruption in the registry. This procedure does not guarantee full recovery of the system to a previous state; however, you should be able to recover data when you use this procedure.

You can repair a corrupted registry in Windows XP. Corrupted registry files can cause a variety of different error messages. Please refer to the Knowledge Base for articles regarding error messages related to registry issues.

This article assumes that normal recovery methods have failed and access to the system is not available except by using Recovery Console.

You should have tried "SAFE MODE" and "restore last known good configuration" from the advanced startups available by pressing F8 in the first few seconds of a reboot and before windows tries to load.

If an Automatic System Recovery (ASR) backup exists, it is the preferred method for recovery; it is recommended that you use the ASR backup before you try the procedure described in this article.

ASR backups can be huge. When I tried to make one I accidentally said to use floppy disks. It said it would take 3 1/2 days to complete the backup. It backs up all your applications. Nearly a complete copy of your hard drive.

NOTE: Make sure to replace all 5 of the registry hives. If you only replace a single hive or two, this can cause potential issues, since software and hardware may have settings in multiple locations in the registry.

MORE INFORMATION

When you try to start or restart your Windows XP-based computer, you may receive one of the following error messages:

Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SOFTWARE

Stop: c0000218 {Registry File Failure} The registry cannot load the hive (file): \SystemRoot\System32\Config\SOFTWARE or its log or alternate

The procedure described in this article uses Recovery Console, System Restore, and lists all the required steps in specific order to ensure that the process completes fully. After you complete this procedure, the system should return to a state very close to the system before the problem occurred.

Part One

In part one, you boot to the Recovery Console, create a temporary folder, back up the existing registry files to a new location, delete the registry files at their existing location, and then copy the registry files from the repair folder to the System32\Config folder. When you are finished with this procedure, a registry is created that you can use to boot back into Windows XP. This registry was created and saved during the initial install of Windows XP.

You do this by running the regcopy1.txt you created above or by manually typing in the commands described in it.

To complete part one, follow these steps:

Boot to the Recovery Console.

A) Boot to "recovery console" from the boot menu. OR

B) Make sure BIOS is set to boot from CD-ROM and reboot.

Press any key to boot from CD-ROM when screen says to.

After a bunch of setup files are loaded, Chose R for recovery console when prompted.
Select installation (usually "1" RETURN unless you have multiple operating systems then get number from the boot menu)
At the Recovery Console command prompt, type the following :

c:\windows\batch regcopy1.txt

or hand type in the dos commands listed in it.

Type exit to quit Recovery Console. Your computer will restart to the install version of XP.

If requested, you may re-activate XP via the internet.(Should not have to re-register) Not sure if this is necessary but have not tried to go without it.

At this point you are the same as if you had reformatted your hard drive and installed XP for the first time and you would have lost all data files, emails, internet settings and everything else that had happened since the initial install. You would then have to spend about a full day reinstalling and re-registering all your applications and restoring any backup data files you were smart enough to make.

HOWEVER, you did not reformat your hard drive and all that stuff is still there. The following parts will get you back to full restore in about 15 minutes

Part Two

To complete the procedure described in this section, you must be logged on as an administrator, or an administrative user (a user who has an account in the Administrators group).

In part two, you copy the registry files from their backed up location by System Restore. This folder is not available in Recovery Console and is normally not visible during normal usage. Before you start this procedure, you must change several settings to make the folder visible:

Start Windows Explorer.
On the Tools menu, click Folder options.
Click the View tab.
Under Hidden files and folders, click to select Show hidden files and folders, and then click to clear the Hide protected operating system files (Recommended) check box.
Click Yes when the dialog box is displayed that confirms that you want to display these files.
Double-click the drive where you installed Windows XP to get a list of the folders. If is important to click the correct drive.
Open the System Volume Information folder. This folder appears dimmed folder because it is set as a super-hidden folder.

NOTE: This folder contains one or more _restore {GUID} folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".

NOTE: You may receive the following error message:

C:\System Volume Information is not accessible. Access is denied.

If you get this message, see the following:

309531 How to Gain Access to the System Volume Information Folder

Windows XP Professional using the NTFS File System on a Workgroup or Standalone Computer

Click Start, and then click My Computer.
On the Tools menu, click Folder Options.
On the View tab, click Show hidden files and folders.
Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
Clear the Use simple file sharing (Recommended) check box.
Click OK.
Right-click the System Volume Information folder in the root folder, and then click Properties.
Click the Security tab.
Click Add, and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on. Click OK, and then click OK.
Double-click the System Volume Information folder in the root folder to open it.

Open any folder that was not created at the current time. You may have to click Details on the View menu to see when these folders were created. There may be one or more folders starting with "RPx under this folder. These are restore points.
Open one of these folders to locate a Snapshot subfolder folder; the following path is an example of a folder path to the Snapshot folder:

I usually pick a snapshot dated the previous day.

C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot
From the Snapshot folder, copy the following files to the C:\Windows\Tmp folder:
- _REGISTRY_USER_.DEFAULT
- _REGISTRY_MACHINE_SECURITY
- _REGISTRY_MACHINE_SOFTWARE
- _REGISTRY_MACHINE_SYSTEM
- _REGISTRY_MACHINE_SAM

using the standard Windows Copy and Paste functions.

Part Three

In part three, you delete the existing registry files, and then copy the System Restore Registry files to the C:\Windows\System32\Config folder:

You do this by running the regcopy2.txt you created above or by manually typing in the commands described in it.

Restart the computer
Boot to the Recovery Console.

A) Boot to "recovery console" from the boot menu. OR

B) Make sure BIOS is set to boot from CD-ROM and reboot.

Press any key to boot from CD-ROM when screen says to.

After a bunch of setup files are loaded, Chose R for recovery console when prompted.
Select installation (usually "1" RETURN unless you have multiple operating systems then get number from the boot menu)
At the Recovery Console command prompt, type the following :

Type exit to quit Recovery Console. Your computer will restart to the previous version of XP.

If requested, you may re-activate XP via the internet.(Should not have to re-register) Not sure if this is necessary but have not tried to go without it.

Part Four

Click Start, and then click All Programs.
Click Accessories, and then click System Tools.
Click System Restore, and then click Restore to a previous Restore Point.

select a restore point previous to the one that clobbered your system: Usually any point prior to the installation of the thing that clobbered you. One dated the previous day usually works.

That's it, you should be back in business.

HOW TO: Install and Use the Recovery Console in Windows XP

SUMMARY

The Windows Recovery console is designed to help you recover when your Windows-Based computer does not start properly or does not start at all. If Safe mode and other startup options do not work, you can consider using the Recovery Console. This method is recommended only if you are an advanced user who can use basic commands to identify and locate problem drivers and files. In addition, you must be an administrator to use the Recovery Console.

back to the top

Installing the Recovery Console

Insert the Windows XP CD into the CD-ROM drive.
Click Start, and then click Run.
In the Open box, type d:\i386\winnt32.exe /cmdcons where d is the drive letter for the CD-ROM drive.
A Windows Setup Dialog Box appears, which describes the Recovery Console option. The system prompts you to confirm installation. Click Yes to start the installation procedure.
Restart the computer. The next time you start your computer, you will see a "Microsoft Windows Recovery Console" entry on the boot menu.

NOTE: Alternatively, you can use a UNC to install the Recovery Console from a network share point.

back to the top

Using the Recovery Console

You can enable and disable services, format drives, read and write data on a local drive (including drives that are formatted to use the NT File System (NTFS), and perform many other administrative tasks. The Recovery Console is particularly useful if you need to repair your computer by copying a file from a disk or CD-ROM to your hard disk, or if you need to reconfigure a service that is preventing your computer from starting properly.

If you cannot start your computer, you can run the Recovery Console from the Microsoft Windows XP startup disks or the Windows XP CD-ROM. This article describes how to perform this task.

After Windows XP is installed on your computer, to start the computer and use the Recovery Console you need the Windows XP startup disks or the Windows XP CD-ROM.

For additional information about how to create Startup disks for Windows XP (they are not included with Windows XP), click the article number below to view the article in the Microsoft Knowledge Base:

310994 Obtaining Windows XP Setup Boot Disks

NOTE: To start the computer from the Windows XP CD-ROM, you need to configure the basic input/output system (BIOS) of the computer to boot from your CD-ROM drive.

To run the Recovery Console from the Windows XP startup disks or the Windows XP CD-ROM, use the following steps:

Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.

Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted to do so.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
If you have a dual-boot or multiple-boot computer, choose the installation that you need to access from the Recovery Console.
When you are prompted to do so, type the Administrator password. If the administrator password is blank, just press ENTER.
At the command prompt, type the appropriate commands to diagnose and repair your Windows XP installation.

For a list of commands that are available in Recovery Console, type recovery console commands or help at the command prompt, and then press ENTER.

For information about a specific command, type help commandname at the command prompt, and then press ENTER.
To exit the Recovery Console and restart the computer, type exit at the command prompt, and then press ENTER.

back to the top

Using the Recovery Console Command Prompt

When you use the Recovery Console, you are working at a special command prompt rather than the usual Windows command prompt. The Recovery Console has its own command interpreter. To enter this command interpreter, you are prompted by Recovery Console to type the Administrator password (the local Administrator, not a domain Administrator).

When the Recovery Console starts, you have the opportunity to press F6 to install a third-party SCSI or RAID driver, in case you need such a driver to access the hard disk. This prompt works the same as it does during installation of the operating system.

The Recovery Console takes a few seconds to start. When the Recovery Console menu is displayed, a numbered list of the Windows installations on the computer is displayed (usually only one entry-c:\Windows-exists). Press a number before you press ENTER, even when only one entry appears. If you press ENTER without choosing a number, the computer restarts and begins the process again.

When you see the prompt for %SystemRoot% (usually C:\Windows), you can begin using the available commands for the Recovery Console.

back to the top

Command Actions

The following list describes the available commands for the Recovery Console:

Attrib changes attributes on one file or subdirectory.
Batch executes commands that you specify in the text file, Inputfile; Outputfile holds the output of the commands. If you omit the Outputfile parameter, output is displayed on the screen.
Bootcfg is used to manipulate the Boot.ini for boot configuration and recovery.
CD (Chdir) operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.
Chkdsk The /p switch runs Chkdsk even if the drive is not flagged as dirty. The /r switch locates bad sectors and recovers readable information; this switch implies /p. Chkdsk requires Autochk. Chkdsk automatically looks for Autochk.exe in the startup (or boot) folder. If Chkdsk cannot find the file in the startup folder, it looks for the Windows 2000 Setup CD-ROM. If Chkdsk cannot find the installation CD-ROM, it prompts the user for the location of Autochk.exe.
Cls clears the screen.
Copy copies one file to a target location. By default, the target cannot be removable media and you cannot use wildcards. Copying a compressed file from the Windows 2000 Setup CD-ROM automatically decompresses the file.
Del (Delete) deletes one file. Operates within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources. You cannot use wildcards by default.
Dir displays a list of all files, including hidden and system files.
Disable disables a Windows system service or driver. The variable service_or_driver is the name of the service or driver that you want to disable. When you use this command to disable a service, it displays the service's original startup type before changing the type to SERVICE_DISABLED. You should note the original startup type so that you can use the enable command to restart the service.
Diskpart manages partitions on hard disk volumes. The /add option creates a new partition; the /delete option deletes an existing partition. The variable device is the device name for a new partition (such as \device\harddisk0). The variable drive is the drive letter for a partition that you are deleting (for example, D); partition is the partition-based name for a partition that you are deleting, (for example: \device\harddisk0\partition1) and can be used in place of the drive variable. The variable size is the size, in megabytes, of a new partition.
Enable enables a Windows system service or driver. The variable service_or_driver is the name of the service or driver that you want to enable, and start_type is the startup type for an enabled service. The startup type uses one of the following formats:
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START
Exit quits the Recovery Console, and then restarts the computer.
Expand expands a compressed file. The variable source is the file that you want to expand; you cannot use wildcard characters by default. The variable destination is the directory for the new file; by default, the destination cannot be removable media and cannot be read-only; you can use the attrib command to remove the read-only attribute from the destination directory. The option /f:filespec is required if the source contains more than one file; this option permits wildcards. The /y switch disables the overwrite confirmation prompt. The /d switch specifies that the files should not be expanded and displays a directory of the files in the source.
Fixboot writes a new boot sector on the system partition.
Fixmbr repairs the boot partition's master boot code. The variable device is an optional name that specifies the device that needs a new MBR; omit this variable when the target is the boot device.
Format formats a disk. The /q switch performs a quick format; the /fs switch specifies the file system.
Help If you do not use the command variable to specify a command, help lists all the commands that the Recovery Console supports.
Listsvc displays all available services and drivers on the computer.
Logon displays detected installations of Windows and requests the local Administrator password for those installations. Use this command to move to another installation or subdirectory.
Map displays currently active device mappings. Include the arc option to specify the use of Advanced RISC Computing (ARC) paths (the format for Boot.ini) instead of Windows device paths.
MD (Mkdir) operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.
More/Type displays the specified text file (such as, filename) on screen.

Net Use connects to a remote share for the Windows XP Recovery Console. The following text describes the syntax for this command:

NET USE [devicename | *] [\\computername\sharename[\volume] [password | *]]
        [/USER:[domainname\]username]
        [/USER:[dotted domain name\]username]
        [/USER:[username@dotted domain name]
        [/SMARTCARD]
        [/SAVECRED]
        [[/DELETE] | [/PERSISTENT:{YES | NO}]]

NET USE {devicename | *} [password | *] /HOME

NET USE [/PERSISTENT:{YES | NO}]

Rd (Rmdir) operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.
Ren (Rename) operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources. You cannot specify a new drive or path as the target.
Set displays and sets the Recovery Console environment variables.
Systemroot sets the current directory to %SystemRoot%.

back to the top

Recovery Console Rules

Several environment rules are in effect while you are working in the Recovery Console. Type set to see the current environment. By default, these are the rules:

AllowAllPaths = FALSE, which prevents access to directories and subdirectories outside the system installation that you selected when you entered the Recovery Console.
AllowRemovableMedia = FALSE, which prevents access to removable media as a target for copied files.
AllowWildCards = FALSE, which prevents wildcard support for commands such as copy and del.
NoCopyPrompt = FALSE, which means that you are prompted by the Recovery Console for confirmation when overwriting an existing file.

back to the top

Deleting the Recovery Console

To delete the Recovery Console:

Restart your computer, click Start, click My Computer, and then double-click the hard disk on which you installed the Recovery Console.
On the Tools menu, click Folder Options, and then click the View tab.
Click Show hidden files and folders, click to clear the Hide protected operating system files check box, and then click OK.
At the root folder, delete the Cmdcons folder and the Cmldr file.
At the root folder, right-click the Boot.ini file, and then click Properties.
Click to clear the Read-only check box, and then click OK.
WARNING: Modifying the Boot.ini file incorrectly may prevent your computer from restarting. Be sure to delete only the entry for the Recovery Console. Also, it is recommended that you change the attribute for the Boot.ini file back to a read-only state after you complete this procedure. Open the Boot.ini file in Microsoft Windows Notepad, and remove the entry for the Recovery Console. It looks similar to this:
C:\cmdcons\bootsect.dat="Microsoft Windows Recovery Console" /cmdcons
Save the file and close it.

DISCLAIMER OF DAMAGES ALMOST ALL DIGITAL ELECTRONICS assumes no liability for damages, direct or consequential, which may result from the use of this information, even if ALMOST ALL DIGITAL ELECTRONICS has been advised of the possibility of such damages.

How to Recover from a Corrupted Registry that Prevents Windows XP from Starting

Installing the Recovery Console

SUMMARY

MORE INFORMATION

Part One

Part Two

Windows XP Professional using the NTFS File System on a Workgroup or Standalone Computer

Part Three

Part Four

That's it, you should be back in business.

HOW TO: Install and Use the Recovery Console in Windows XP

IN THIS TASK

SUMMARY

Installing the Recovery Console

Using the Recovery Console

Using the Recovery Console Command Prompt

Command Actions

Recovery Console Rules

Deleting the Recovery Console

DISCLAIMER OF DAMAGES
ALMOST ALL DIGITAL ELECTRONICS assumes no liability for damages, direct or consequential, which may result from the use of this information, even if ALMOST ALL DIGITAL ELECTRONICS has been advised of the possibility of such damages.